The following recommendations are designed to enhance cybersecurity, improve the effectiveness and efficiency of the US Government, set the Nation on a path for sustained growth, and better serve the American people.

Data minimization requirements are an increasing focus of privacy laws around the world, including state privacy laws in the US.

Twenty states have enacted comprehensive consumer privacy laws that create new rights for consumers, impose obligations on businesses that handle consumers’ personal data, and create new mechanisms to enforce those laws.

To build a cyber incident reporting ecosystem that serves governments’ needs while not unduly encumbering businesses’ ability to respond to and recover from cyber incidents, cyber incident reporting requirements should follow these recommendations.